CVE-2026-18516: Improper Encoding or Escaping of Output

An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...

PT-2026-124554

TuxCare rebuilt web3-providers-http to address 1 CVE. Fixed in 1.10.4-tuxcare.1...

UBUNTU-CVE-2026-109829

undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handle...

UBUNTU-CVE-2026-87018

undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does no...

CVE-2026-87111: Improper Neutralization of Input During Web Page Generation

The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due to insufficient input sanitization and output escaping. Thi...

PT-2026-115878

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

UBUNTU-CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

UBUNTU-CVE-2026-18662

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous...

PT-2026-115527

Name of the Vulnerable Software and Affected Versions User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin versions prior to 6.3.0 Description The premium build of the plugin contains a flaw due to insufficient input sanitization and output escaping. Thi...

Apache HTTP Server 2.4.49 Path Traversal / Remote Code Execution

Apache HTTP Server version 2.4.49 contains a path traversal vulnerability that can read arbitrary files and, when modcgi is enabled with permissive access controls, execute commands. This proof of concept demonstrates both conditions. https://packetstorm.news/download/236046...

PT-2026-115643

Name of the Vulnerable Software and Affected Versions pupnp versions prior to 2.0.2 Description The HTTP parser in upnp/src/genlib/net/http/httpparser.c fails to correctly handle Transfer-Encoding: chunked requests. Specifically, the parser parse chunky entity and parser parse chunky body functio...

PT-2026-115889

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

Linux Distros Unpatched Vulnerability : CVE-2026-87018

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when ...

Important: mount-s3

Issue Overview: Improper handling of HPACK dynamic table size updates in the AWS Common Runtime aws-c-http library might allow a remote threat actor operating a server to cause memory corruption on a connecting client application, potentially leading to arbitrary code execution, via a crafted...

Amazon Linux 2023 : mount-s3 (ALAS2023-2026-3233)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3233 advisory. Improper handling of HPACK dynamic table size updates in the AWS Common Runtime aws-c-http library might allow a remote threat actor operating a server to cause memory corruption on a connecting client...

Linux Distros Unpatched Vulnerability : CVE-2026-104150

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by...

Linux Distros Unpatched Vulnerability : CVE-2026-87029

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed...

Linux Distros Unpatched Vulnerability : CVE-2026-70188

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over...

CentOS Linux 7 [TuxCare] Security Update: httpd / httpd-devel / httpd-manual / httpd-tools / mod_ldap / etc (CENTOS7:CLSA-2026:1791855215)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1791855215 advisory. - Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache...

Linux Distros Unpatched Vulnerability : CVE-2026-88092

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to perform tampering over a...